SebastianVerified account

Mitm? That's an irresponsible way to describe the simple and common reverse proxy. You should read this: https://en.m.wikipedia.org/wiki/Reverse_proxy …

There's no legitimate technical reason for Yarn to man-in-the-middle traffic to the npm registry. If it's not spyware, it's at least icky

I believe they used to just have a CNAME that pointed to the npm registry but now it's proxying with an A record. Why?

Even if just for analytics, it's not worth the risk. Now if either npm *or* yarn is hacked, you are compromised.

I'm sure @sebmck has good intentions, but does his reverse proxy have all patches applied? At least npm pays for security audits

I think there's still some confusion around how our proxy actually works. We use Cloudflare which is literally reverse proxy as a service.

Cloudflare are the ones who handle security updates. Being concerned about Cloudflare's security makes sense but odds are you're already...